nginx.conf

# nginx config for the cargo-iq SPA container.
#
# Two jobs:
#   1. Serve the built Vite bundle with SPA history fallback (deep links work).
#   2. Reverse-proxy the API surface to the `app` service on the compose network,
#      so the browser only ever talks to this one origin — no CORS, no
#      VITE_API_BASE_URL juggling (the client uses same-origin /api/... paths).

server {
    listen       80;
    server_name  _;
    root         /usr/share/nginx/html;
    index        index.html;

    # gzip for the text assets the SPA ships.
    gzip on;
    gzip_types text/plain text/css application/javascript application/json image/svg+xml;
    gzip_min_length 1024;

    # Long-cache the fingerprinted assets; never cache the HTML shell.
    location /assets/ {
        expires 1y;
        add_header Cache-Control "public, immutable";
        try_files $uri =404;
    }

    # --- API surface proxied to the Spring Boot app on the compose network ---
    # `app` resolves via Docker DNS; the upstream port is the container's 8080.
    location /api/            { proxy_pass http://app:8080; }
    location /mcp             { proxy_pass http://app:8080; }
    location /actuator/       { proxy_pass http://app:8080; }
    location /v3/api-docs     { proxy_pass http://app:8080; }
    location /swagger         { proxy_pass http://app:8080; }
    location /swagger-ui/     { proxy_pass http://app:8080; }

    # Shared proxy headers for all of the above.
    proxy_set_header Host              $host;
    proxy_set_header X-Real-IP         $remote_addr;
    proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    # The browser sends an Origin header on POSTs even for same-origin requests.
    # From the browser's view these ARE same-origin (nginx is the origin), but
    # the backend would otherwise see Origin :3000 vs its own :8080 and reject it
    # as a disallowed CORS request (403). Strip it so the backend treats these as
    # the same-origin requests they are. (An empty value makes nginx omit it.)
    proxy_set_header Origin            "";
    proxy_http_version 1.1;
    # MCP Streamable HTTP can stream; don't buffer or prematurely time out.
    proxy_buffering off;
    proxy_read_timeout 300s;

    # --- SPA fallback: anything else renders the app shell ---
    location / {
        try_files $uri $uri/ /index.html;
    }
}